depproof
Scanner live on the GitHub Marketplace

Know exactly what you ship. Self-hosted software composition analysis for Java, JavaScript, Python and Go.

  • The whole tree, and a number for how much was read. Maven resolves from source, with no build.
  • What ships, apart from what only builds it. Dev and test dependencies are flagged, not mixed in.
  • Caught in the pull request. Licenses and advisories checked before merge, and a CycloneDX SBOM from every run.
Start your first audit → Explore the Hub →

Free for open source & teams under $1M revenue · runs on your own infrastructure 

- uses: depproof/depproof-action@v1
  with:
    fail-on: high  # critical | high | medium | low | none
Point it at any of these
pom.xml gradle.lockfile package-lock.json pnpm-lock.yaml yarn.lock poetry.lock uv.lock go.mod

How it works

One container, inside your own infrastructure

The software composition analysis runs in your CI. It resolves the full transitive dependency tree and checks every component for known vulnerabilities and license obligations.

How depproof runs Inside your own infrastructure, your manifests feed the depproof scanner, which runs as one container in CI. It emits an HTML report, a CycloneDX SBOM and a pass or fail gate, and sends each scan to the self-hosted depproof hub. The only thing crossing the network boundary is dependency coordinates, sent to public advisory and licence data. YOUR INFRASTRUCTURE · source and findings never leave it Your repositories pom.xml package-lock.json go.mod manifests and lockfiles depproof scanner one container, in CI no build step to arrange full transitive tree and how much resolved What you get HTML report CycloneDX SBOM pass / fail build artifacts, every run depproof hub every repository at once posture · policy evidence on demand public advisory & licence data a dependency’s name and version only · never your code
The only thing that crosses the boundary is a dependency’s name and version. Exactly what does and doesn’t leave your network →

The part nobody reports

Your scanner found three problems. How many did it look for?

Every dependency scanner reports what it found. None reports how much of the tree it could read first — so a complete answer and a half-read one arrive looking exactly the same.

Why a short findings list is ambiguous Two dependency trees side by side. The first is fully resolved, every node read. The second is partly resolved: whole branches were never read and are shown as dashed outlines. Both produce an identical result of three findings and an identical passing exit code, so nothing downstream can tell them apart. Fully resolved tree every node read Partly resolved tree whole branches never read 3 findings · exit 0 3 findings · exit 0 =
Identical report, identical exit code. One is good news; the other is the warning that looks exactly like good news. depproof states its own coverage on every scan, can fail the build when it is not enough, and carries the same number up to the hub — so an estate dashboard tells you which repositories it could not see all of, instead of quietly averaging them in.
Run it on one repository → Why a clean report can mislead →

What changes

Caught on a branch, not in an incident

You already do all of this. It just happens later, by hand, and after something shipped.

The moment How it goes today How it goes with depproof
A vulnerable dependency reaches a release You hear it from an advisory, an auditor or a customer. The fix is an incident: someone is paged, a patch window opens, teams stop what they were doing. The build failed on it. One person, one branch, before it ever shipped.
A critical CVE is published You ask every team and wait. The answer is whoever replied. Already answered. Every repository reported on its last scan.
A customer sends a security questionnaire Somebody assembles the inventory by hand, per product. It was a build artifact before they asked.
An auditor asks what you deferred “Ignored” is one list. Assessed and never-looked-at share a row. Two separate claims, each with an owner and a date.

We are not going to put a figure on what that saves you. Any number we quoted would be ours rather than yours. The better one is the one you already have: how long did your last critical advisory take to answer across every repository, and how sure were you of the answer?

What you get

The scanner knows. The hub proves.

One repo at a time, and every repo at once. No vendor cloud in the path, and no subprocessor for a customer to vet.

The scanner

One repo at a time. Maven resolves straight from source, with no build and no lockfile; npm and Python from the lockfile, Go from its module graph. Every open-source license classified, every component checked against open OSV advisory data.

The hub

Every repo at once. The estate-level questions a single scan can’t answer — is this CVE anywhere, which products carry a license we prohibit, what’s the current SBOM — plus waivers with an owner, a justification and an expiry, on an audit trail — the dependency governance layer a single scan cannot provide. The machine-readable bill of materials the EU Cyber Resilience Act asks for from 11 December 2027 is a build artifact here, not a project.

Prove · the hub

From one repo to your whole estate.

The questions above, answered on screen — with every repository you have in it.

depproof hub health screen: build gate, vulnerability and licence rings across ten repositories, with a banner warning that seven of ten did not fully resolve their dependency graph.
Security & compliance health Posture across every repository — and how much of each dependency tree actually resolved.

1/3

Explore the Hub →

Or write to hello@depproof.com — a real person reads it.

Who it’s for

One scan, read by three people for different reasons

Which is why one run returns a report, an SBOM and an exit code, rather than only whichever one of the three you happened to ask for.

Developers & platform

“Is this pull request safe to merge, and if not, what do I change?”

They meet it in the pull request, several times a day — a verdict fast enough not to break their flow, and enough of the tree to know which upgrade clears the most.

Start your first audit →

Security

“A vulnerability was announced this morning. Are we exposed, and where?”

They read across repositories rather than within one, and they own the risk that cannot be fixed today — which means recording who accepted it, and until when.

Explore the Hub →

Compliance & legal

“An auditor has asked what we ship. What do I send them?”

Evidence that was generated rather than assembled by hand, current as of a date they can point to — including which copyleft licenses are in the tree.

Answering an SBOM request →

In most organisations these are not three people. Below a few hundred staff they are commonly one or two wearing all three hats in turn — which is precisely why it matters that one run answers all three questions instead of each role buying its own tool.

Fit

Where it fits best

The people we hear from most, not the whole list. If none of these is quite you, it is still worth asking.

  • Your code and findings can’t leave your infrastructure — and you can’t staff an HA cluster and a platform team to keep them in it.
  • You’re unwilling to pay per seat just to give security a dashboard, and you want open data with no lock-in to a host or a proprietary vulnerability database.

One thing we don’t do: container and OS package scanning. Not at all — and if that is the requirement, Trivy is free and better at it.

How depproof compares

An honest, capability-by-capability view.

  • ✅ shipping today
  • 🟡 partial or conditional
  • ⚪ not offered
Capability Host-native
(GH / GitLab)		 SaaS scanner Heavy self-hosted depproof
Runs on your own infrastructure * 🟡 self-managed editions ⚪ SaaS ✅ ✅ no special edition
Full transitive tree — licenses and CVEs 🟡 caveated ✅ runs build ✅ ✅ Maven with no build
Org-wide dashboard & blast radius ✅ ✅ ✅ ✅ depproof hub
Self-hostable without a platform team n/a hosted n/a SaaS ⚪ server + DB + HA ✅
Open, portable advisory data 🟡 GitHub open · GitLab closed ⚪ proprietary ⚪ proprietary ✅ OSV
Pricing model per-committer per-developer per-application per product · free <$1M

* Your code and findings never leave your network. How we keep it that way →

One workflow file, one repository, minutes.

No account, no signup, no call with us. Free for open source and for organisations under $1M revenue — and priced per product after that.

Start your first audit → Answering an SBOM request →

Questions first? Write to hello@depproof.com.